Based on my review, there are two conclusions that can be drawn from the 
EDPB recommendations / guidelines. 


(1) Third countries (as well as many EU countries or the UK) rarely if ever 
meet the EEG requirements. This means that, beyond the 8 sovereign 
States/12 entities (with hardly any economic relevance) that have the 
opportunity of benefiting today from an EU adequacy decision, few if no 
other countries at all might be considered as offering a protection 
“essentially equivalent” to that offered by EU law. 


(2) If third countries are not considered as “adequate/essentially equivalent”, 
then data transfers to them are lawful only if supplemental measures are 
adopted by the data exporter. The EDPB Guidance seems nonetheless to 
prohibit almost all such transfers when the personal data is readable in the 
third country. 


That means global (incl. UK) employers will have to immediately stop doing 
business in the EU and dismiss their staff until they have set-up isolated data 
systems and management for their EU subsidiaries — and it is unlikely that 
they will do so any time soon. 


The implications of the EDPB position in its current writing might be: regular 
transfers to third countries are almost always unlawful if the personal data 
can be read in the third country. 


Global companies depend on intercompany data transfers for HR or CRM 


purposes. Prohibiting this causes yet another international crisis with mass- 
dimissals and people’s economic existence at risk. 


|, personally, would e.g. lose my job, if intercompany data transfers for HR 
purposes were prohibited. 


| work as a recruiter for a US IT company and support their EU recruiting for 
EU subsidiaries. 


Please do not let this happen. 


